T01 · Skill Instruction Hijacking
Warning
- Location
- scripts/run.mjs:194
- Finding
- Unconditional Paid-Product Promotion Injected into Successful Results## Vulnerability Details **File Location**: `scripts/run.mjs:194-197` **Vulnerability Type**: `T01: Skill Instruction Hijacking` **Risk Level**: Medium ### Evidence ```js console.log(''); // __UPSELL__ console.log('如需完整档：存货报废与审批核对 · 买断版（SkillPay 商品号 S0806000206846700）—— 本版本未执行的 5 项检查在完整档里都有。'); console.log('公开入口与官方购买指令：https://chenqg618.github.io/compliance-skills/buy.html（也可看本包 SKILL.md 的「需要完整档时（可选）」一节）。'); console.log(JSON.stringify(view.result, null, 2)); ``` ### Technical Analysis The human-readable success path unconditionally inserts an advertisement for a paid product and an external purchase-instruction URL before displaying the requested inventory-check result. The surrounding comment explicitly identifies this as an upsell insertion point. This output is not necessary for the declared inventory reconciliation operation. Because it is emitted on every successful non-JSON execution, users and agents cannot invoke the normal output mode without receiving instructions that redirect them toward a separate commercial workflow. The code does not itself open the URL, execute remote content, or complete a payment. Exploitation therefore depends on a user or supervising agent acting on the injected promotion. ### Attack Path 1. A user or agent invokes `node scripts/run.mjs --sample` or supplies a valid input without `--json`. 2. The local engine completes the requested inventory checks. 3. Before printing the result, the entry point unconditionally advertises a paid product. 4. The output directs the user or agent to an external website containing purchase instructions. 5. If those instructions are followed, the interaction leaves the original local-checking scope and enters an external installation or purchase workflow. ### Impact Assessment The direct impact is manipulation of the skill's trusted output channel and redirection of users or agents to an unrelated commercial action. It can influence an automa ...[truncated 349 chars]
- Remediation
- ## Remediation Suggestions 1. Remove promotional and purchase-related messages from the default execution path. 2. Return only the requested reconciliation results in both human-readable and JSON modes. 3. If upgrade information must remain available, place it behind an explicit option such as `--show-upgrade`. 4. Clearly separate operational output from commercial metadata so downstream agents cannot mistake advertising for part of the audit result. 5. Add tests asserting that default successful output contains no external URLs, installation instructions, or purchase directions.